From fb2789081ff73958d778bfa7a83246bf2b350d8d Mon Sep 17 00:00:00 2001 From: Carl Vitullo Date: Wed, 21 Oct 2026 19:13:25 -0400 Subject: [PATCH] Pin Node base image to 24.22.1 for October 2026 security release Fixes CVE-2026-111497 (Brotli OOB write / RCE) and the TLS hostname verification bypasses in the same release. Co-Authored-By: Claude Opus 5.5 Moves off end-of-life Node 20; CI moves 22 -> 24 to match. --- .github/workflows/node.js.yml | 2 +- Dockerfile | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/node.js.yml b/.github/workflows/node.js.yml index 17d60092..7d1eccdc 100644 --- a/.github/workflows/node.js.yml +++ b/.github/workflows/node.js.yml @@ -20,7 +20,7 @@ jobs: # TODO: see if we need to do anything special to cache docker images - uses: actions/setup-node@v3 with: - node-version: 22 + node-version: 24 cache: npm - name: Login to GitHub Container Registry diff --git a/Dockerfile b/Dockerfile index fa9d73a1..65b8755d 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,4 +1,4 @@ -FROM node:20-alpine as build +FROM node:24.22.1-alpine as build WORKDIR /build/reactibot COPY package.json package-lock.json ./ @@ -10,7 +10,7 @@ COPY src ./src RUN npm run test RUN npm run build -FROM node:20-alpine +FROM node:24.22.1-alpine RUN apk --no-cache add \ ghostscript \